Calculate everything on the server
That is: you tell the server where you want to move and who you want to attack (if abilities are targeted, as many are with MOBAs) or in which direction (if the ability is aimed directionally, like in most first-person shooters on PC). The server will then calculate whether your move is valid (i.e. it's actually possible to move that far) and whether your attack hits, how much damage is done (including critical hits) and whether anything else needs to happen (e.g. an attack could freeze the target or push them away).
People might try to cheat by telling the server they're doing a lot more damage than possible. The server keeping track of this information is required to prevent this.
Multiple clients doing their own calculations would be messy
Let's say I try to attack you, but I have latency of a few seconds. You moved out of range a while ago, but I still see you next to me, so that attack would be valid from my point of view.
Now I tell the server to subtract some of your health. Now what? Should the server do that and suddenly you take a bunch of damage despite no-one being around you any more? Or should the server realise the attack isn't valid any more and send back to me that you suddenly regain the health I already subtracted? Neither option would be a good user experience (you shouldn't be playing with that much lag, but lag spikes happen, and the problem also exists with lower latency).
The above applies to whether or not you hit, but a similar problem happens with regard to how much damage is done: We're attacking each other and I see you lose all your health while I still have a bunch. So I won that fight, right? But you, on the other hand, see the same (due to the update delay between us, and each of us only know about the damage we're dealing). So you also won? There isn't a good way to resolve that either.
Footnote regarding calculating on both the client and server:
In some cases in these games, some calculations happen on the client as well as the server, to reduce lag (so the client can update without waiting for the server). The states would then be synchronised between the two (which sometimes results in "desync", where you jump backwards to where you were a few seconds ago - you may have seen this in one of many popular games).
For your own movement, this could make sense, as you know where you're currently busy moving and there isn't (much) probabilities involved in how that happens. It would only a big problem when there's a significant delay, which is assumed to be an exception rather than the norm, and the alternative would having a very irritating delay on every single move you make (even if your latency is fairly low).
Damage, on the other hand, needs to consider where the target is, whether they're still alive, whether you actually hit them (if I generate a number, or roll some dice, which says I hit and the server does the same to determine that I miss, there is a problem), or did a "critical hit" , any modifiers that might be affecting how much damage is done and possibly other factors. If you try to do the calculation on both the client and server, health counters would constantly jump up and down when the client guesses some of these things wrong, which would arguably be a much worse experience than just having the damage take a little while to show up on the target.
That's not to say it's completely nonviable to do the calculation on both in some scenarios, it's just quite a bit harder in a lot of cases than doing the same for movement (which is already nontrivial).